Soft Machine: Cross-tenant workspace API authentication bypass
Summary
Soft Machine versions up to and including 0.2.247 accept a global CONTAINER_SHARED_SECRET as bearer token on workspace APIs without checking which workspace the caller belongs to. The secret is present in every workspace container and reachable by tenant code, so an authenticated user of one workspace can read, write, back up and restore other tenants' workspaces. Exploitation requires a valid workspace account and network adjacency to peer workspaces.
Affected
- Soft Machine versions up to and including 0.2.247
- Workspace APIs /backup, /restore, /bind, /file, /archive, /upload-file and /upload-archive
Fixed in
Unknown. No patch was publicly known at the time of publication.
Workaround
Unknown. No vendor workaround is documented in the sources reviewed.
Exploitation
- CISA SSVC: exploitation status 'poc', automatable 'no', technical impact 'total'
- Not listed in CISA KEV
- Public proof-of-concept availability is disputed between sources
- No known in-the-wild exploitation
Our recommendation
- If you use the hosted service, ask Soft Machine in writing for the patch status, a fix timeline and whether the shared secret has been rotated
- If you self-host, rotate CONTAINER_SHARED_SECRET and restrict who can create or reach workspaces
- Review workspace logs for unexpected cross-workspace requests
- Do not store credentials or secrets in workspaces until a fix is confirmed
- Check whether CVE-2026-46711 also affects your deployment
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-63gh-vp9f-vxhj github.com
- OpenCVE CVE-2026-55176 app.opencve.io
- Strix CVE-2026-55176 www.strix.ai
- CISA Vulnrichment CVE-2026-55176 vulners.com
- The Hacker Wire CVE-2026-55176 www.thehackerwire.com
- Soft Machine download page soft-machine.io
- Strix CVE-2026-46711 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 08:22.
Original description (NVD)
Soft Machine is a Virtual Machine–based agentic development environment / Cloud OS. In versions 0.2.247 and prior, two authentication helpers in /app/server.js — verifyContainerAuth() and authenticateWorkspaceHttp() — accept the global CONTAINER_SHARED_SECRET as a bearer token without verifying which workspace the caller belongs to. Because that secret is set identically on every container in the Fly app and is reachable from the user-facing process environment inside each workspace, any tenant can use it to authenticate to any other tenant's workspace API. The result is cross-workspace read, write, and destructive-restore primitives reachable from any paying customer's shell. The existing per-workspace token check (workspaceTokenMatches) protects the user-facing per-workspace token path, but the shared-secret bearer path bypasses it entirely. At time of publication, there are no publicly known patches.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.